<form action="<?php echo $_SERVER['PHP_SELF']; ?>">
//there is no reason to use this to submit form data to the same page
<form action="">
//will do the same thing
// Here is how to post form data to self or to the same page &
// avoid the PHP_SELF exploits at the same time.
<form name="my_form" method="post"
action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
</form>
